(Optional) One or more secret encryption keys, created and distributed by users to allow other users to encrypt and decrypt fields in a document.
Note: If a user is in the process of requesting a new private key or a name change, the pending information is also stored in the ID file. If a Notes private key is changed, then the obsolete information is also stored in the ID file for backwards compatibility. For example, you would need the obsolete information to read old encrypted email.
Certificates
A certificate is a unique digital signature that identifies a user or server. Server and user IDs contain one or more HCL Notes certificates. In addition, user IDs may contain one or more Internet certificates that identify users when they use TLS to connect to an Internet server or send a signed S/MIME mail message.
Notes clients and two-factor authentication
HCL Notes client authentication with a Notes ID provides built-in, automatic, two-factor authentication.
Password-protection for Notes and Domino IDs
To ensure the security of the Domino system, password-protect all Notes and Domino IDs -- certifier, server, and user. When you password-protect an ID, a key that is derived from the password encrypts the data on the ID. Then, when you attempt to access mail, open a server-based database, or examine ID file information, you are prompted to enter a password.
The password quality scale
When creating passwords for user, server, or certifier IDs, you need to understand the criteria by which Domino measures password strength and security. Domino measures this criteria according to the level assigned on its password quality scale. The scale assigns a minimum level of quality to the password on an ID file. Domino bases the password quality on the number and variety of characters in the password.
Verifying user passwords during authentication
You can enable password verification so that a Notes user can authenticate with a server only after providing the correct password that is associated with the user ID.
Setting up password verification
You can enable password verification through the use of a security policy settings document, which allows you to enable this feature for multiple users, or you can enable password verification on an individual basis through the Domino Directory.
Custom password policies
Information protection and data privacy laws include specific requirements for the selection of secure passwords for identity verification. To help users comply with these laws, HCL Domino includes the ability to implement password restrictions on a policy basis. Administrators can enforce password requirements that will fit almost any set of corporate or government security requirements.
Assigning multiple passwords to server and certifier IDs
To assign multiple passwords to server and certifier IDs, all of the administrators whose passwords will be assigned to the ID must be present. Then, during the procedure of assigning multiple passwords, each administrator completes a series of steps.
Using Notes Shared Login to suppress password prompts
Notes Shared Login (NSL) allows users to start Notes without having to provide Notes passwords. Instead, they only need to log in to Microsoft™ Windows™ using their Windows passwords.
Using Notes Shared Login to secure server ID files
Starting with HCL Domino 12.0.1, you can secure the server ID files of Domino servers on Windows using the Notes Shared Login (NSL) functionality.
Notes ID vault
The ID vault is an optional, server-based database that holds protected copies of Notes user IDs. An ID vault allows administrators and users to easily manage Notes user IDs. Users are assigned to a vault through policy configuration, and copies of user IDs are uploaded to a vault automatically once the policy has taken effect.
ID recovery
Use of the ID vault for ID recovery is strongly recommended. However, the ID recovery feature described in this topic is still supported.
Public key security
Every Notes user ID and Domino server ID has a unique public key for the Notes certificate. The public key is stored in an ID file and in the Person or Server document for that ID in the Domino Directory. Notes and Domino use the public key to authenticate users and servers, verify digital signatures, and encrypt messages and databases. A Notes user ID can also have a unique public key for an Internet certificate.
User and server key rollover
Key rollover is the process used to update the set of Notes public and private keys that is stored in user and server ID files. Periodically, this set of keys may need to be replaced -- as a precaution against undetected compromise of the private key; as a remedy to recover from a known compromise of the private key; or to increase security by updating to a larger key.
Using cross-certificates to access servers and send secure S/MIME messages
Domino uses both Notes and Internet cross-certificates. Notes cross-certificates allow users in different hierarchically-certified organizations to access servers and to receive signed mail messages. Internet cross-certificates allow users to receive signed mail messages and send encrypted mail messages.
Adding cross-certificates to the Domino Directory or Contacts
You can use several methods to obtain an HCL Notes or Internet cross-certificate.